User identification techniques provide data security in a computer network or other communications system by allowing a given user to prove its identity to one or more other system users before communicating with those users. The other system users are thereby assured that they are in fact communicating with the given user. The users may represent individual computers or other types of terminals in the system. A typical user identification process of the challenge-response type is initiated when one system user, referred to as the Prover, receives certain information in the form of a challenge from another system user, referred to as the Verifier. The Prover uses the challenge and the Prover's private key to generate a response, which is sent to the Verifier. The Verifier uses the challenge, the response and a public key to verify that the response was generated by a legitimate prover. The information passed between the Prover and the Verifier is generated in accordance with cryptographic techniques which insure that eavesdroppers or other attackers cannot interfere with the identification process.
It is well known that a challenge-response user identification technique can be converted to a digital signature technique by the Prover utilizing a one-way hash function to simulate a challenge from a Verifier. In such a digital signature technique, a Prover applies the one-way hash function to a message to generate the simulated challenge. The Prover then utilizes the simulated challenge and a private key to generate a digital signature, which is sent along with the message to the Verifier. The Verifier applies the same one-way hash function to the message to recover the simulated challenge and uses the challenge and a public key to validate the digital signature.
One type of user identification technique relies on the one-way property of the exponentiation function in the multiplicative group of a finite field or in the group of points on an elliptic curve defined over a finite field. This technique is described in U.S. Pat. No. 4,995,082 and in C. P. Schnorr, “Efficient Identification and Signatures for Smart Cards,” in G. Brassard, ed., Advances in Cryptology—Crypto '89, Lecture Notes in Computer Science 435, Springer-Verlag, 1990, pp. 239-252. This technique involves the Prover exponentiating a fixed base element g of the group to some randomly selected power k and sending it to the verifier. An instance of the Schnorr technique uses two prime numbers p and q chosen at random such that q divides p−1, and a number g of order q modulo p is selected. The numbers p, q, and g are made available to all users. The private key of the Prover is x modulo q and the public key y of the Prover is g−x modulo p. The Prover initiates the identification process by selecting a random non-zero number z modulo q. The Prover computes the quantity gz modulo p and sends it as a commitment to the Verifier. The Verifies selects a random number w from the set of integers {1, 2, . . . , 2t} where t is a security number which depends on the application and in the above-cited article is selected as 72. The Verifier sends w as a challenge to the Prover. The Prover computes a quantity u that is equal to the quantity z+xw modulo q as a response and sends it to the Verifier. The Verifier accepts the Prover as securely identified if gz is found to be congruent modulo p to the quantity guyz.
Another type of user identification technique relies on the difficulty of factoring a product of two large prime numbers. A user identification technique of this type is described in L. C. Guillou and J. J. Quisquater, “A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory,” in C. G. Gunther, Ed. Advances in Cryptology—Eurocrypt '88, Lecture Notes in Computer Science 330, Springer-Verlag, 1988, pp. 123-128. This technique involves a Prover raising a randomly selected argument g to a power b modulo n and sending it to a Verifier. An instance of the Guillou-Quisquater technique uses two prime numbers p and q selected at random, a number n generated as the product of p and q, and a large prime number b also selected at random. The numbers n and b are made available to all users. The private key of the Prover is x modulo n and the public key y of the Prover is x−b modulo n. The Prover initiates the identification process by randomly selecting the number g from the set of non-zero numbers modulo n. The Prover computes the quantity gb modulo n and sends it as a commitment to the Verifier. The Verifier randomly selects a number c from the set of non-zero numbers modulo b and sends c as a challenge to the Prover. The Prover computes the number h that is equal to the quantity gxc modulo n as a response and sends it to the Verifier. The Verifier accepts the Prover as securely identified if gb is found to be congruent modulo n to hbyc.
Another type of user identification technique relies on the difficulty of finding a polynomial with small coefficients taking a specified set of values modulo q. A user identification technique of this type is described in Jeffrey Hoffstein, Daniel Lieman, Joseph H. Silverman, Polynomial Rings and Efficient Public Key Authentication, Proceeding of the International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99), M. Blum and C. H. Lee, eds., City University of Hong Kong Press. This technique involves a Prover choosing polynomials with small coefficients and publishing the values modulo q at X=b for values of b in a set S. The Prover also selects commitment polynomials with small coefficients and sends their values at X=b for b in S to the Verifier. The Verifier chooses small polynomials as the challenge and sends them to the Prover. The Prover computes and sends to the Verifier a polynomial formed from the various other polynomials as the response. The Verifier accepts the Prover as securely identified if the response polynomial has small coefficients and has the correct value at X=b for every value of b in S.
Another type of user identification technique relies on the difficulty of finding close vectors in a lattice. An identification technique of this type is described in Goldreich, S. Goldwasser, and S. Halevi, Public-key cryptography from lattice reduction problems, Proceedings of CRYPTO'97, Lecture Notes in Computer Science 1294, Springer-Verlag, 1997. In this method an almost orthogonal basis for a lattice is selected as a secret key and a non-orthogonal basis of the same lattice is published as the public key. The Verifier chooses a random vector (via a secure hash function) as the challenge. The Prover uses the good almost orthogonal basis to find a lattice vector that is close to the challenge vector and sends this lattice vector to the Verifier. The Verifier accepts the Prover as securely identified if the response vector is in the lattice and is sufficiently close to the challenge vector. In the method of Goldreich, Goldwasser, and Halevi, the public key is a complete basis for a randomly selected lattice, and thus has size on the order of N2 bits for a lattice of dimension N. The large size of the public key makes this method impractical for many applications.
Another type of user identification technique that also relies on the difficulty of finding close vectors in a lattice is described in J. Hoffstein, J. Pipher, and J. H. Silverman, NSS: An NTRU Lattice-Based Signature Scheme, Advances in Cryptology-Eurocrypt '01, Lecture Notes in Computer Science, Springer-Verlag, 2001. In this method the lattice has a convolution modular structure, which allows the public key (i.e., the lattice) to be described using a single vector of size on the order of N*log(N) bits. However, this method uses an auxiliary prime to attach the challenge to the lattice point, which renders it insecure.
Although the above-described Schnorr, Guillou-Quisquater, Hoffstein-Lieman-Silverman, Goldreich-Goldwasser-Halevi, and Hoffstein-Pipher-Silverman techniques can provide acceptable performance in many applications, there is a need for an improved technique which can provide security and greater computational efficiency than these and other prior art techniques.